SSSD / sssd

#682 check_if_ccache_file_is_used() might fail if ccache is on NFS
Closed: Invalid Opened by sbose.

Closed: Invalid
Reopen Issue

check_if_ccache_file_is_used() is called from the krb5 provider with root privileges and will fail is the ccache file is on NFS where root access is not allowed. The same is true for check_for_valid_tgt(). To solve this the ccache file needs to be checked by the krb5_child with the privileges of the corresponding user.

The solution can be implemented in two different ways:

  • instead of calling check_if_ccache_file_is_used() and check_for_valid_tgt() a krb5_child is forked and returns the relevant data. This will not change the workflow in the krb5 provider during authentication/change password/access control operations, but will fork krb5_child two times during authentication.

  • all the checks are move from the krb5 provider to krb5_child. With this solution krb5_chikd is forked only once for an authentication, but the workflow is changed considerable and a lot of tests are needed to avoid regressions.

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.6.0
priority: major => minor

Fields changed

coverity: =>
milestone: SSSD 1.6.0 => SSSD 1.7.0
upgrade: => 0

Fields changed

milestone: SSSD 1.8.0 => SSSD 1.9.0
patch: => 0

Fields changed

blockedby: =>
blocking: =>
milestone: SSSD 1.9.0 => SSSD Kerberos improvements
rhbz: =>

Fields changed

rhbz: => 0

Having ccache on the NFS is not a good practice. I do not think it makes sense to ever do. With the recent changes in Fedora to consolidate ccache in .../run/user makes this even less relevant. The direction we expect is to have secure NFS using Kerberos to be deployed more and more. In this case ccache would not be on the NFS anyways.
Moving to NEEDS_TRIAGE with the intent to close or defer.

feature_milestone: =>
proposed_priority: => Undefined

Fields changed

milestone: SSSD Kerberos Improvements Feature => NEEDS_TRIAGE

Fields changed

milestone: NEEDS_TRIAGE => SSSD Kerberos Improvements Feature
resolution: => wontfix
status: new => closed

Metadata Update from @sbose:
- Issue set to the milestone: SSSD Kerberos Improvements Feature

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1724

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
None
High
defect
Kerberos Provider
1.4.0
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.